Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-25T17:00:35 pnpm: pacquet: pnpm and pacquet: Information disclosure of environment secrets via improper environment variable expansion 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CWE-15

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious repository could cause dependency resolution to send victim environment secrets to an attacker-selected registry before lifecycle scripts run. This vulnerability is fixed in 10.34.2 and 11.5.3.

A flaw was found in pnpm and pacquet. A malicious repository could exploit this vulnerability by crafting specific .npmrc or pnpm-workspace.yaml files. When these package managers process these files, they improperly expand environment variable placeholders, leading to the disclosure of sensitive victim environment secrets to an attacker-controlled registry. This could result in unauthorized access to confidential information.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat AMQ Broker 7 Fix deferred pnpm Red Hat Build of Keycloak Fix deferred pnpm Red Hat JBoss Enterprise Application Platform 8 Fix deferred pnpm Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred pnpm https://www.cve.org/CVERecord?id=CVE-2026-55180 https://nvd.nist.gov/vuln/detail/CVE-2026-55180 https://github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r